config.c: Prevent UB in ast_realtime_require_field.

A backend's implementation of the realtime 'require' function may call
va_arg() and then fail, leaving the va_list in an undefined
state. Pass a copy of the va_list instead.

ASTERISK-29771 #close

Change-Id: I555565a72af84e96d49f62fe8cb66ba5a78461f4

diff --git a/main/config.c b/main/config.c
index 46f05aaf163f0c696600d639ada86e44fbfe459c..c5e42fa8a92dd6e3b8d808ab179cbd12f48306c0 100644 (file)
--- a/main/config.c
+++ b/main/config.c
@@ -3384,16 +3384,19 @@ int ast_realtime_require_field(const char *family, ...)
        struct ast_config_engine *eng;
        char db[256];
        char table[256];
-       va_list ap;
+       va_list ap, aq;
        int res = -1, i;
 
        va_start(ap, family);
        for (i = 1; ; i++) {
                if ((eng = find_engine(family, i, db, sizeof(db), table, sizeof(table)))) {
+                       va_copy(aq, ap);
                        /* If the require succeeds, it returns 0. */
-                       if (eng->require_func && !(res = eng->require_func(db, table, ap))) {
+                       if (eng->require_func && !(res = eng->require_func(db, table, aq))) {
+                               va_end(aq);
                                break;
                        }
+                       va_end(aq);
                } else {
                        break;
                }